- What is whitehat101/apr1-md5 and what does it do?
- It is a small pure-PHP implementation of Apache's APR1-MD5 hash, the $apr1$ scheme used in .htpasswd files, and it can both generate and check those hashes. The API surface is essentially two static calls, hash and check, with no PHP extensions required. It is intended as a compatibility utility for legacy credentials, not as a general password-hashing library.
- How do I install whitehat101/apr1-md5 with Composer?
- Install it with composer require whitehat101/apr1-md5. The package is dependency-free and MIT-licensed, so there are no extensions, config files, or service providers to enable. It exposes a single static class, so you can call it directly or, preferably, wrap it behind your own interface.
- Does this package integrate with Laravel's Hash facade?
- Not out of the box; it ships no service provider, facade, config, or Laravel conventions. The cleanest hook is registering a custom driver via Hash::extend() with an implementation of Illuminate\Contracts\Hashing\Hasher whose needsRehash() returns true for every $apr1$ value. That keeps the rest of the application on Hash::check() and confines the legacy path to a single seam.
- How do I verify an existing .htpasswd password in a Laravel application?
- Load the stored $apr1$ hash for the user, pass the plaintext and hash to the package's check method, and treat a true result as a successful legacy login. On success, immediately re-hash the plaintext with Hash::make() and persist the new value so the account leaves the legacy path. Never call the static class directly from controllers, middleware, or models; keep it behind a verifier interface or driver.
- Can I use APR1-MD5 for new password storage?
- No. APR1-MD5 is fast and MD5-based, which makes it obsolete for new credential storage and weak against modern offline cracking. It should only be used as a read-and-verify bridge for existing Apache-managed hashes with a defined exit criterion. Any request to hash new passwords with it is a security escalation, not a package decision.
- How do I migrate users from APR1-MD5 to bcrypt or Argon2id?
- Enable rehash-on-login: verify against the legacy hash, and on success immediately call Hash::make() with bcrypt or Argon2id and save the result. Copy imported hashes verbatim during bulk import, because re-hashing an existing hash is a defect. Track migrated users with telemetry and retire the legacy path when your migrated-user threshold or sunset date is reached.
- Is whitehat101/apr1-md5 safe to depend on in production long term?
- Treat it as a time-boxed, vendored dependency rather than a long-term one. The project has a small maintainer footprint, few stars, no dependents, and no evident security response process, so there is little to lean on if an issue appears. Because it is MIT-licensed you can vendor and pin the roughly 100 lines, own the copy, and delete it on a schedule.
- Does the package's check() method use a constant-time comparison?
- This is unverified and should be confirmed before any credential verification ships. Read the source end-to-end, and if the comparison is not timing-safe, wrap it or replace it with hash_equals() in your adapter. Record the finding in your decision log with a named owner.
- Which PHP versions does whitehat101/apr1-md5 support, and how is it tested?
- PHP version support is unclear from the project metadata and test coverage is thin, so verify compatibility against your target runtime yourself. Add contract tests using Apache-generated fixtures, such as output from htpasswd -m, so your verification behaviour is pinned to real APR1 hashes. That gives you regression safety independent of the package's own test suite.
- What are the alternatives to using APR1-MD5 in PHP?
- If you control the credential store, use Laravel's Hash facade with bcrypt or Argon2id and never introduce APR1 at all. If you must interoperate with existing Apache htpasswd files, the alternatives are writing the roughly 100 lines yourself or extracting the algorithm into a vendored internal utility. Either way, the migration policy, rehash-on-login flow, and sunset criteria matter far more than the library choice.